{
  "id": "auth-challenge-trusted-proxy-hardening",
  "name": "auth-challenge-trusted-proxy-hardening",
  "title": "认证验证码与可信代理安全收口",
  "description": "修复密码重置多码并存、弱随机、账号级失败锁缺失、验证码并发重复消费及可信代理/IP 限流绕过，并同步收口邮箱验证码共用安全边界。",
  "status": "in_progress",
  "dev_type": null,
  "scope": "security/auth-challenge-trusted-proxy",
  "package": "server",
  "priority": "P0",
  "creator": "shunli",
  "assignee": "shunli",
  "createdAt": "2026-07-17",
  "completedAt": null,
  "branch": null,
  "base_branch": "main",
  "worktree_path": null,
  "commit": null,
  "pr_url": null,
  "subtasks": [],
  "children": [],
  "parent": null,
  "relatedFiles": [
    ".trellis/tasks/07-16-system-multidimensional-audit/research/business-security-review.md",
    ".trellis/spec/hyb-oa/backend-fastify-prisma.md",
    ".trellis/spec/hyb-oa/security-privacy.md",
    ".trellis/spec/hyb-oa/deployment-trialrun.md",
    "server/src/routes/auth.js",
    "server/src/app.js",
    "server/src/config.js",
    "server/prisma/schema.prisma",
    "deploy/trialrun/docker-compose.yml",
    "deploy/trialrun/nginx-hyb-oa.conf"
  ],
  "notes": "用户于 2026-07-17 批准 P0 设计。实现、只读复核、完整本地门禁和隔离 PostgreSQL 并发验证已通过；临时库与容器已删除。未授权也未执行公网配置、部署、现有/生产数据写入或生产迁移；当前仅待用户确认独立提交。",
  "meta": {}
}